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Chapter 1 802.1x Configuration Commands 


1.1 802.1x Configuration Commands 


802.1x configuration commands include: 


dot1x enable 

dot1x port-control 

dot1x authentication multiple-hosts 
dot1x authentication multiple-auth 
dot1x default 

dot1x reauth-max 

dot1x re-authentication 

dot1x timeout quiet-period 

dot1x timeout re-authperiod 

dot1x timeout tx-period 

dot1x mab 

dot1x mabformat 

dot1x user-permit 

dot1x authentication method 
dot1x accounting enable 

dot1x accounting method 

dot1x authen-type. dot1x authentication type 
dot1x guest-vilan 

dot1x guest-vian id 

dot1x forbid multi-network-adapter 
dot1x keepalive 

dot1x vendor-permit 

dot1x vendor 


aaa authentication dot1x 
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e debug dot1x error 
e debug dot1x state 
e debug dot1x packet 


e show dot1x 


1.1.1 dot1x enable 


Syntax 


To enable 802.1x, run the following command. 
dot1x enable 
To return to the default setting, use the no form of this command. 


no dot1x enable 
Parameters 

None 
Default Value 

None 
Command Mode 

Global configuration mode 
Usage Guidelines 


If the 802.1x function is not enabled, you cannot start it on an interface. If the 802.1x 
function is forbidden, all interfaces have no the 802.1x function, and at the same time, 
all 802.1x packets will not be received by CPU but can be forwarded inVLANlike normal 
multicast packets. 


Command Mode 
Global configuration mode 
Example 


The following example shows how to enable dot1x. 


Switch_config#dot1x enable 
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Switch_config # 


1.1.2 | dot1x port-control 


Syntax 


To configure the port based authentication mode, run the following command: 
dot1x port-control {auto|force-authorized|force-unauthorized} 
To return to the default setting, use the no form of this command. 


no dot1x port-control 


Parameters 
Parameters Description 

auto Enables the 802.1x authentication mode. 

force-authorized Disables 802.1X on the interface and causes the port to change 
to the authorized state without any authentication exchange 
required. 

force-unauthorized Denies all access through this interface by forcing the port to 
change to the unauthorized state, ignoring all attempts by the 
client to authenticate. 


Default Value 

force-authorized 
Command Mode 

Interface configuration mode 
Usage Guidelines 


The 802.1x protocol is an interface-based two-layer authentication mode. You can run 
the auto command to enable the authentication mode. This authentication mode can be 
configured only on the physical interface and the interface’s attributes cannot include 
VLAN backbone, dynamical access, security port or listening port. 


The command is not supported in the PON port. 
Command Mode 


Port configuration mode 
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Example 


The following example shows how to enable 802.1x on interface g0/1. 
Switch_config _g0/1# dot1x port-control auto 


The following example shows how to firstly set interface gO0/1 to the VLAN backbone 
and then enable 802. 1x. 


Switch_config _g0/1#switchport mode trunk 
Switch_config _g0/1#dot1x port-control auto 
802.1x Control Failed, can't config 802.1x on vianTrunk port(GigaEthernet0/1) 


1.1.3. dot1x authentication multiple-hosts 


Syntax 


To configure multi-host access mode of 802.1x, run the following command: 
dot1x authentication multiple-hosts 
To return to the default setting, use the no form of this command. 


no dot1x authentication multiple-hosts 
Parameters 

None 
Default Value 

Disabled 
Usage Guidelines 


Set one port to the multi-hosts mode of 802.1x, and the switch will authenticate different 
users. When one user passes the authentication, the port sets to the “up” state. Other 
users can access the port without authentication. 


Note: After modifying the multi-host authentication mode, all users of the port will be 
authenticated again. 


Command Mode 


Port configuration mode 
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Example 


The following example shows how to enable multi-hosts authentication on interface 
gO/1. 


Switch_config _g0/1# dot1x authentication multiple-hosts 
Switch_config _g0/1# 


1.1.4 dot1x authentication multiple-auth 


Syntax 


To configure multiple-auth authentication mode of 802.1x, run the following command: 
dot1x authentication multiple-auth 
To return to the default setting, use the no form of this command. 


no dot1x authentication multiple-auth 
Parameters 
None 
Default Value 
Disabled 
Command Mode 
Interface configuration mode 
Usage Guidelines 


Set one port to the multi-hosts mode of 802.1x, and the switch will authenticate different 
users. When only one user passes its authentication, the interface will be up; only when 
all users fail in their authentication, in another word, only when no successfully 
authenticated user exist on the interface, the interface will be down. This mechanism 
gives guarantee to respective authentication for each user and if a user fails in its 
authentication, other users still have the normal access rights. 


Note: The multi-auth mode cannot coexist with guest vlan or mab. If an interface is in 
multi-authen mode, all users on the interface will be authenticated again. 


Command Mode 


Port configuration mode 
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Example 


The following example shows how to enable multi-auth authentication on interface g0/1. 


Switch_config _g0/1# dot1x authentication multiple-auth 
Switch_config _g0/1# 


1.1.5 dot1x default 


Syntax 


To return to the default setting, run the following command. 


dot1x default 
Parameters 
None 
Default Value 
None 
Usage Guidelines 
This command is used to resume all global configurations to the default settings. 
Command Mode 
Global configuration mode 
Example 
The following example shows how to resume all dot1x configuration parameters to their 


default values. 


Switch_config #dot1x default 
Switch_config # 


1.1.6 dot1x reauth-max 


Syntax 


To configure the times of re-authentication, run the following command: 


dot1x reauth-max count 
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To return to the default setting, use the no form of this command. 


no dot1x reauth-max 


Parameters 


Parameters Description 


count Maximum authentication re-try times, ranging between 1 and 10 


Default Value 


Command Mode 
Global configuration mode 
Usage Guidelines 


This command is used to set the authentication retry times. If the retry times exceeds 
the maximum retry times and the client has no response, the authentication is mounted. 


Command Mode 
Global configuration mode 
Example 
The following example shows how to configure the maximum times of dot1x identity 


authentication request to 4. 


Switch_config #dot1x reauth-max 4 
Switch_config # 


1.1.7 dot1x re-authentication 


Syntax 


To enable re-authentication, run the following command: 
dot1x re-authentication 
To disable re-authentication, run the following command: 


no dot1x re-authentication 
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Parameters 
None 
Default Value 
None 
Command Mode 
Global configuration mode 
Usage Guidelines 


After an interface passes authentication, the interface will still perform authentication to 
hosts in a certain period. You can run dot1x timeout re-authperiod to configure the 
period. 


Example 


The following example shows how to enable the re-authentication function. 


Switch_config #dot1x re-authentication 
Switch_config # 


1.1.8 dot1x timeout quiet-period 


Syntax 


To configure the quiet-period after the authentication failure, run the following 
command: 


dot1x timeout quiet-period time 
To return to the default setting, use the no form of this command. 


no dot1x timeout quiet-period 


Parameters 


Parameters Description 


time Period for restarting dotix authentication, ranging between 0 
and 65535 seconds 


Default Value 


60s 
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Command Mode 
Global configuration mode 
Usage Guidelines 


There is a certain period when the OLT cannot perform any authentication after the 
previous authentication fails. 


Example 


The following example shows how to set the value of quiet-period to 40. 


Switch_config #dot1x timeout quiet-period 40 
Switch_config # 


1.1.9 dot1x timeout re-authperiod 


Syntax 


To configure the re-authentication period of dot1x, run the following command: 
dot1x timeout re-authperiod time 
To return to the default setting, use the no form of this command. 


no dot1x timeout re-authperiod 


Parameters 


Parameters Description 


time dotix re-authentication period, ranging between 1 and 
4294967295s 


Default Value 

3600s 
Command Mode 

Global configuration mode 
Usage Guidelines 


This command validates only when the re-authentication function is enabled. 
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Example 


The following example shows how to set the dot1x re-authentication period to 7200 
seconds. 


Switch_config # dot1x timeout re-authperiod 7200 


Switch_config # 


1.1.10 dot1x timeout tx-period 


Syntax 


To configure the time interval of the host client responses to the authentication request, 
run the following command: 


dot1x timeout tx-period time 


To return to the default setting, use the no form of this command. 


no dot1x timeout tx-period 


Parameters 


Parameters 


Description 


time 


Time which ranges between 1 and 65535 seconds 


Default Value 


30s 


Command Mode 


Global configuration mode 


Usage Guidelines 


This command is used to set the client’s authentication request response interval. If the 
interval is exceeded, the switch would retransmit the authentication request. 


Example 


The following example shows how to set the transmission frequency to 24. 


Switch_config # dot1x timeout tx-period 24 
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1.1.11 dot1x mab 


Syntax 


To enable mab authentication, run the following command: 
dot1x mab 
To return to the default setting, use the no form of this command. 


no dot1x mab 
Parameters 

None 
Default Value 

The debugging switch is disabled. 
Usage Guidelines 


When a peer device cannot run the 802.1x client software, the OLT will adopt the MAB 
authentication mode and then the MAC address of the peer device will be sent as both 
the username and password to the radius server for authentication. 


When the MAB authentication is enabled and the peer device, however, neither sends 
the eapol_start packet nor responds to the request_identity packet and exceeds the 
timeout threshold, the OLT regards this case as the evidence of not support the 802.1x 
authentication client on the peer device and then turns to the MAB authentication. 
When the switch sends the gained MAC address as the username and password to the 
Radius server for authentication, the authentication will still not succeed until the 
Radius server has authorized this MAC address. 


Note: The MAB authentication mode cannot coexist with the multi-auth mode. 
Command Mode 

Port configuration mode 
Example 


The following example shows how to enable mab authentication on port g0/1. 


Switch_config _g0/1# dot1x mab 
Switch_config _g0/1# 
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1.1.12 | dot1x mabformat 


Syntax 


To configure the mac address format of OLT forwarding to radius server, run the 
following command: 


dot1x mabformat {1/2|3|4|5/6} 
To return to the default setting, use the no form of this command. 


no dot1x mabformat 


Parameters 
Parameters Description 
1 Format of the MAC address: aa:bb:cc:dd:ee:ff 
2 Format of the MAC address: aa:bb:cc:dd:ee:ff 
3 Format of the MAC address: aabbccddeeff 
4 Format of the MAC address: AABBCCDDEEFF 
5 Format of the MAC address: aa-bb-cc-dd-ee-ff 
6 Format of the MAC address: AA-BB-CC-DD-EE-FF 


Default Value 
The default is 1. 
Usage Guidelines 


When the MAB authentication is enabled, you can set the format of the MAC address to 
the Radius server through this command. 


Command Mode 
Global configuration mode 
Usage Guidelines 


The command can be used to set the format of the MAC address of OLT forwarding to 
radius server when enable mab authentication. 


Example 


The following example shows how to set the format of MAC to 3. 
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Switch_config # dot1x mabformat 3 
Switch_config # 


1.1.13 dot1x user-permit 


Syntax 


To configure the port binding user, run the following command: 
dot1x user-permit xxx yyy zzz 
To return to the default setting, use the no form of this command. 


no dot1x user-permit 


Parameters 
Parameters Description 
XXX A user name 
yyy A user name 
ZZz A user name 


Default Value 

No user is bound and all users would pass. 
Command Mode 

Port configuration mode 
Usage Guidelines 


This command can be used to bind users on an interface. Each interface can be bound 
to up to eight users. When the 802.1x authentication is enabled, the authentication is 
performed only to those bound users. However, to those unbound users, the 
authentication must fail. 


Example 


The following example shows how to bind users a, b, c and d on interface g0/1. 


Switch_config _g0/1# dot1x user-permit ab cd 
Switch_config _g0/1# 


802.1x Configuration Commands 


1.1.14 | dot1x authentication method 


Syntax 


To configure the authentication method under the port, run the following command: 


dot1x authentication method xxx 


To return to the default setting, use the no form of this command. 


no dot1x authentication method 


Parameters 


Parameters 


Description 


XXX 


Method name 


Default Value 


Default method 


Usage Guidelines 


This command is used to configure the authentication method which must be one of 
authentication methods provided by AAA. One interface only uses one authentication 
method. When AAA performs authentication to the 802.1x user, AAA would select the 
configured authentication method to perform the authentication. 


Command Mode 


Port configuration mode 


Example 


The following example shows how to set the authentication method on interface g0/1 to 
abcd which applies the local username for authentication and that on interface g0/2 to 
efgh which applies the remote radius authentication. 


Switch_config #aaa authentication dot1x abcd local 


Switch_config #aaa authentication dot1x efgh group radius 


Switch_config _g0/1# dot1x authentication method abcd 


Switch_config _g0/1# interface g0/2 


Switch_config _g0/2# dot1x authentication method efgh 


802.1x Configuration Commands 


1.1.15 | dot1x accounting enable 


Syntax 


To enable the accounting function under the port, run the following command: 
dot1x accounting enable 
To disable the accounting function under the port, run the following command: 


no dot1x accounting enable 
Parameters 
None 
Default Value 
The accounting service is disabled by default. 
Command Mode 
Port configuration mode 
Usage Guidelines 


This command is used to enable the accounting function on a port which runs with the 
authentication function. You'd better enable the dot1x re-authentication function when 
the accounting function is running. 


Example 


The following example shows how to configure the dot1x authentication function on 
interface g0/1 and enable the accounting function. 

Switch_config #dot1x enable 

Switch_config # interface g0/1 

Switch_config _g0/1# dot1x port auto 

Switch_config _g0/1# dot1x accounting enable 


1.1.16 dot1x accounting method 


Syntax 


To configure the accounting method under the port, run the following command: 


dot1x accounting method xxx 
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To return to the default setting, use the no form of this command. 


no dot1x accounting method 


Parameters 


Parameters Description 


XXX Name of the accounting method 


Default Value 


Default method 


Command Mode 


Port configuration mode 


Usage Guidelines 


This command is used to configure an accounting method on a port. This method must 
be one of the accounting methods provided by AAA. Each port has only one accounting 
method. When the dot1x accounting function is enabled, this method will be used for 
accounting. 


Example 


Le 


The following example shows how to set the accounting method on interface g0/1 to 
abcd, which uses the radius server. 


Switch_config # aaa accounting network abcd start-stop group radius 
Switch_config #radius host 192.168.20.100 

Switch_config # interface g0/1 

Switch_config _g0/1# dot1x accounting method abcd 


dot1x authen-type, dot1x authentication type 


Syntax 


To configure the dot1x authentication type in global configuration mode, run dot1x 
authen-type; to resume the default settings in global configuration mode, run no dot1x 
authen-type. 

dot1x authen-type {chap|eap} 


no dot1x authen-type 


To configure the dot1x authentication type on an interface, run dot1x authentication 
type; to resume the default settings on an interface, run no dot1x authentication type. 
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dot1x authentication type {chap|eap} 


no dot1x authentication type 
Parameters 

None 
Command Mode 

Interface or global configuration mode 
Default Value 


The default dot1x authentication type is eap. 


The default dot1x authentication type in global configuration mode is also used applied 
by default in interface configuration mode. 


Usage Guidelines 


The authentication type decides whether AAA uses the CHAP authentication or the 
EAP authentication. If the CHAP authentication is used, the challenge required by MD5 
is locally generated; if the EAP authentication is used, the challenge is generated on the 
authentication server. Only one authentication mode can be applied to one interface. By 
default, the authentication mode is applied in global mode. When an authentication 
mode is configured for an interface, the authentication mode will be always used on the 
interface unless the negative form of the command is run to resume the default 
settings. 


Example 


The following example shows how to set the authentication type on interface g0/1 to 
chap and the global authentication type to eap. 


Switch_config #dot1x authen-type eap 
Switch_config # interface g0/1 
Switch_config _g0/1# dot1x authentication type chap 


1.1.18 | dot1x guest-vlan 


Syntax 


To enable the guest-vlan function of dot1x in global configuration mode, run dot1x 
guest-vlan. To disable the guest-vlan function of dot1x in global configuration mode, run 
no dot1x guest-vlan. 


dot1x guest-vlan 
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no dot1x guest-vlan 


Parameters 


None 


Default Value 


Disabled 


Command Mode 


Global configuration mode 


Usage Guidelines 


After the guest-vian function is enabled, the corresponding port can be grouped into the 
guest vlan and specific network access rights are attributed to the port if a guest 
terminal does not respond. 

This command is used together with the dot1x guest-vlan id command. 


Note: This command cannot be set together with the multiple-auth command. 


Example 


i et) 


The following example shows how to enable guest-vlan in the global configuration 
mode: 


Switch_config #dot1x guest-vlan 


dot1x guest-vlan id 


Syntax 


To configure the value of dot1x guest-vlan id on an interface, run dot1x guest-vlan id; to 
resume the default value 0, run no dot1x guest-vlan. 


dot1x guest-vlan id 


no dot1x guest-vlan 


Parameters 


ID: stands for the value of guest vlan, which can be any vlan ID configured in the 
system. 
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Default Value 

None 
Command Mode 

Port configuration mode 
Usage Guidelines 


After the guest-vlan function is enabled, the corresponding port can be grouped into the 
guest vian and specific network access rights are attributed to the port if a guest 
terminal does not respond. 


This command is used together with the dot1x guest-vlan id command. 


Note: This command cannot be set together with the multiple-auth command. 


Example 


The following example shows how to configure the guest-vian id on port g0/1. 


Switch_config _g0/1#dot1x guest-vlan 2 


1.1.20  dot1x forbid multi-network-adapter 


Syntax 


To forbid the supplicant of the multi-network-adapter on an interface, run dot1x forbid 
multi-network-adapter. To resume the default settings, run no dot1x forbid 
multi-network-adapter. 


dot1x forbid multi-network-adapter 


no dot1x forbid multi-network-adapter 
Parameters 

None 
Default Value 

None 
Command Mode 


Port configuration mode 
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Usage Guidelines 


This command can be used to forbid the supplicant terminal with multiple network 
adapters, preventing an agent from being occurred. 


Example 


The following example shows how to forbid the supplicant terminal with multiple network adapters 
on port g0/1. 


Switch_config _g0/1 # dot1x forbid multi-network-adapter 


1.1.21 dot1x keepalive 


Syntax 


To enable the keepalive detection for the authentication user in the global configuration 
mode, run the following command. To return to the default setting, use the no form of 
this command. 


dot1x keepalive 


no dot1x keepalive 
Parameters 
None 
Default Value 
Enabled 
Command Mode 
Global configuration mode 
Usage Guidelines 
The keepalive detection is enabled by default. 
Example 
The following example shows how to enable or disable the keepalive detection for the 


authentication user. 


Switch_config #no dot1x keepalive 
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1.1.22 


dot1x vendor-permit 


Syntax 


To enable vendor forwarding function in the global configuration mode, run the following 
command. To return to the default setting, use the no form of this command. 


dot1x vendor-permit 


no dot1x vendor-permit 


Parameters 


None 


Default Value 


The debugging switch is disabled. 


Command Mode 


Global configuration mode 


Usage Guidelines 


The command is used to enable vendor forwarding function. The command enables the 
switch forwards vendor information to the radius authentication server during the 
authentication. The command is disabled by default. 


The command is used with dot1x vendor command. 


Example 


11223 


The following example shows how to enable the vendor forwarding function in global 
configuration mode. 


Switch_config #dot1x vendor-permit 


dot1x vendor 


Syntax 


To set vendor information provided by radius server, run the first one of the above 
commands. To return to the default setting, use the no form of this command. 


dot1x vendor word 
no dot1x vendor 
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Parameters 


Parameters Description 


word Vendor information 


Default Value 
None 
Command Mode 
Global configuration mode 
Usage Guidelines 
The command is used to set vendor information. 
Example 
The following example shows how to set the name of vendor to LENOVO in the global 


configuration mode. 


Switch_config #dot1x vendor LENOVO 


1.1.24 aaa authentication dot1x 


Syntax 


aaa authentication dot1x {default | word } method1 [| method2...] 


no aaa authentication dot1x { default | word} 


Parameters 
Parameters Description 
default Default method Uses the authentication method when command 
dot1x authentication method does not run. 
word Designate the name of the authentication method 
method? [method2...] group radius, group tacacst+, local, local-case, none 


Default Value 


None 
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Command Mode 
Global configuration mode 
Usage Guidelines 


The method parameter provides a series of methods to authenticate the password of 
the client host. You'd better adopt the radius as the AAA authentication mode of 802.1x. 
You can also use the local configuration data for authentication, such as user password 
saved in the local configuration. 


Example 
The following example shows how to configure the dot1x authentication method to 


RADIUS. 


Switch_config #aaa authentication dot1x default group radius 
Switch_config # 


1.1.25 debug dot1x errors 


Syntax 


To output the error information in running dot1x, run the following command: 


debug dot1x errors 
Parameters 

None 
Default Value 

None 
Usage Guidelines 


This command is used to export all error information occurred during dot1x running. 
The error information can help locating the errors. 


1.1.26 debug dot1x state 


Syntax 
To output the status information in running dot1x, run the following command: 
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debug dot1x state 
Parameters 
None 
Default Value 
None 
Command Mode 
Privileged mode 
Usage Guidelines 


The following shows the format of information output: 


2015-3-18 17:40:09 802.1x:AuthSM(g0/1) state Connecting-> Authenticating, event rxRespld 
2015-3-18 17:40:09 802.1x:g0/1 Create user for Enter authentication 

2015-3-18 17:40:09 802.1x:BauthSM(g0/1) state Idle-> Response, event authStart 
2015-3-18 17:40:09 802.1x:g0/1 user "myname" denied, Authentication Force Failed 
2015-3-18 17:40:09 802.1x:g0/1 Authentication Fail 

2015-3-18 17:40:09 802.1x:BauthSM(g0/1) state Response-> Fail, event aFail 


1.1.27 debug dot1x packet 


Syntax 


To output the packet information in running dot1x, run the following command: 


debug dot1x packet 
Parameters 

None 
Default Value 

None 
Command Mode 


Privileged mode 
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Usage Guidelines 


2015-3-18 17:40:09 802.1xg0/1 Tx --> Supplicant(0008.74bb.d21f) 
EAPOL _ver:01, type:00, len:5 
EAP code:01, id:03, type:01, len:5 


00 


2015-3-18 17:40:09 802.1x:g0/1 Rx <-- Supplicant(0008.74bb.d21f) 
EAPOL  ver:01, type:00, len:10 
EAP code:02, id:03, type:01, len:10 


62 64 63 6f 6d a5 


1.1.28 show dot1x 


Syntax 


To display the 802.1x configuration information, run the previous following command. 


show dot1x [interface intf-id | statistics] 


Parameters 
Parameters Description 
interface Displays dot1x interface information. 
Intf-id Stands for a specific physical interface. 
Statistics Displays dot1x statistics information. 


Default Value 


None 


Command Mode 


Other modes except the user mode 


Usage Guidelines 


This command is used to display the 802.1x configuration information. 


Example 


The following example shows how to display 802.1x configuration information. 


Switch_config#show dot1x 


802.1X Parameters 


reAuthen 
reAuth-Period 


No 
3600 
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quiet-Period 
Tx-Period 
Supp-timeout 
Server-timeout 
reAuth-max 
max-request 
authen-type 


Eap 
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